ML20215B648

In-Progress Audit of Dcrdr for San Onofre Nuclear Generating Station Unit 1

ML20215B648
Person / Time
Site:	San Onofre
Issue date:	09/29/1986
From:	SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY
To:	NRC
Shared Package
ML13330B142	List: ML20215B648
References
CON-NRC-03-82-096, CON-NRC-3-82-96 NUDOCS 8610080108
Download: ML20215B648 (25)

Text

- _ - __ .

ENCLOSURE 1 IN-PROGRESS AUDIT OF THE DETAILED CONTROL ROOM DESIGN REVIEW FOR SOUTHERN CALIFORNIA EDISON COMPANY'S SAN ON0FRE NUCLEAR GENERATING STATION UNIT 1 Septcmber 29, 1986

f i

(

1 Prepared by:

Science Applications International Corporation s

2

Prepared for

U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Contract NRC-03-82-096 3

1

• _ &lbosnict gg,

Table of Contents Section g

INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . , , . }

DISCUSSION . . . . . . . . . . . . . . . . . . . . . . , . . . . . . 2 1.

2. Establishment of a qualified multidisciplinary team . . . . 2 Function and task analysis to identify control room operater tasks and information and control requirements during emergency operation

3. ................

Comparison of display and control requirements with a 3 control room inventory

4. .................. 6 Control room survey to identify deviations from accepted human factors principles

5. .................

Assessment of human engineering discrepancies HEDs to 8

6.

determine which are significant and should be c(orrec)ted . . 10 f Selection of design improvements

7. ............. 14 F Verification that s91ected design improvements will provide

{ 8. the necessary correction and not introduce new HEDs . . . . 16

) Coordination of control room improvements with changes from other programs such as the Safety Parameter Display System, operator training, Reg. Guide 1.97 instrumenta-tion, and upgraded emergency operatin

9. Operating experience review . . . . .g procedures . . . . . 16

........... 17 CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2

APPENDIX A - DCRDR Audit Exit Meeting

............... A-1 i APPENDIX B - NRC Audit Team Minisurvey Results . . . . . . . . . . . B-1

I IN-PROGRESS AUDIT OF THE l DETAILED CONTROL ROOM DESIGN REVIEW FOR l

SOUTHERN CALIFORNIA EDIS0N COMPANY'S SAN ON0FRE NUCLEAR GENERATING STATION UNIT 1 INTRODUCTION Southern Califou.ia Edison (SCE) submitted a Detailed Control Room Design Review (DCRDR) Program Plan (Reference 1) for the San Onofre Nuclear Generating Station, Unit 1 (SONGS-1) in December 1985. Based on Science Applications International Corporation's (SAIC) evaluation of the Program Plan, the NRC planned and conducted an In-Progress Audit of the SONGS-1 DCRDR during July 15-18, 1986. The purpose of the audit was threefold:

1. To clarify the DCRDR methodology

2. To audit documentation of the DCRDR to date

3. To provide feedback to the licensee on the acceptability of the DCRDR being conducted The audit was conducted by a team comprised of two NRC members, two consultants from SAIC, and one consultant from Comex Corporation, a subcon-tractor to SAIC. The disciplines of human factors and nuclear systems and g operations were represented on the team.

9 The In-Progress Audit included presentations by the licensee and the contractor personnel responsible for different portions of the DCRDR; I

discussion of completed activities and those yet to be completed; review of DCRDR documentation; and visits to the control room, remote shutdown panel, and mock-up. Appendix A provides the list of attendees at the exit briefing held at the end of the audit.

L This report documents the findings of the In-Progress Audit. It was

j. compiled. and integrated by SAIC with input from Comex Corporation and the NRC staff. The report ~ represents the consolidated observations, conclusions, and recommendations of the audit team.

1 l

l . - - . . .- - -

.

• l l

DISCUSSION

1. Establishment of a cualified multidisciolinary team.

The organization for conduct of a successful DCRDR can vary widely, but is expected to conform to the criteria developed in Section 18-1, Appendix A, of NUREG-0800 (Reference 2). Overall, administrative leadership should be provided by a utility employee. The DCRDR team should be given suffi-cient authority to carry out its mission. A core group of specialists in the fields of human factors engineering and nuclear engineering are expected to participate with assistance from other disciplines. Staffing for each technical task should provide appropriate expertise with human factors expertise included in the staffing for technical tasks. Finally, the DCRDR

team should receive an orientation which contributes to the success of the

[- DCRDR.

t The licensee's Program Plan described the composition of the review team as having a core group of specialists in the fields of human factors engineering, plant operations, and nuclear and electrical / instrumentation and controls (I&C) engineering.

This core group includes personnel who are also knowledgeable in licensing, training, program management, and other NUREG-0737, Supplement 1 (Reference 3) programs-such as Safety Parameter e Display System (SPDS) and, upgrade of Emergency Operating Instructions (E0Is). Resumes for most members of this core group were provided. A 1,

review of this information indicated that the core review team had the I; multidisciplinary composition and qualifications suggested in NUREG-0700 (Reference 4). However, the Program Plan failed to provide two key resumes and did not mention whether the core group will be supplemented by personnel with other expertise that may be needed for lighting and noise surveys.

During the In-Progress Audit, the licensee provided the requested resumes and presented several changes in review team personnel previously described in the Program Plan. The audit team reviewed the current DCRDR team composition and qualifications and found it to be acceptable. Addi-tionally, SCE indicated that the core team will be supplemented by personnel with other expertise. Finally, a chart was provided that summarized the level of participation of the review team members. A review of this chart indicated that the task assignments and levels of effort were satisfactory.

2

In conclusion, the personnel comprising the DCRDR core team meet the i

qualifications recommended in NUREG-0800, and the licensee should be able to accomplish the DCRDR in accordance with NUREG-0737, Supplement I require-ments.

2. Function and task analysis to identify control room operator tasks and information and control recuirements durina emeroency operation.

The objective of the system function and task analysis that will be perforced at SONGS-1 is to establish the input and output requirements of control room operators' tasks under emergency conditions. To accomplish this, the licensee conducted a top-down approach to the function and task

~

analysis beginning with an identification of systems and system functions using SONGS-1 E01 Bases Documents, System Descriptions, and other existing

[. plant documentation. The function (s) of the system (s) and the conditions under which they are used were described. The licensee defined a set of scenarios using SONGS-1 safety, and safety-related systems and function descriptions. Each scenario was briefly described in order to establish the limits and conditions of the events to be analyzed. Scenarios chosen were checked to ensure that they adequately sample "various" emergency conditions and the plant systems and functions used in those conditions.

2 As a first step in the actual task analysis process, operator tasks required in each scenario were identified from the Westinghouse Owner's Group (WOG) Emergency Response Guidelines, Rev. 1 (ERGS). Secondly, the

,o

, operator tasks were broken down into plant-specific steps using the E0Is to reflect a step-by-step procedural set of actions that must be carried out in order to accomplish the task. The task steps along with a brief description of the tasks were recorded on task analysis worksheets. ' Thirdly, operator.

decisions and actions linked to task performance were then identified and.

recorded on the task analysis worksheets. Branching points in the E0Is that required decision-making by the operator were also recorded. Finally, information and control requirements for successful task performance were developed and marked on the worksheets. Recorded variables include system components, specific parameter values, " relevant characteristics," and procedural infomation. This information was based on "EDIs, E01 Bases Documents, and Technical Specifications" (p. 3-16, Reference 1).

3

Although function and task analysis as described in the Program Plan was fairly comprehensive in scope, the reviewers had several concerns.

First, the licensee stated that the set of plant systems and subsystems selected for the analysis will be " comparable" to safety and sa fety-related systems from the WOG Emergency Response Guidelines (ERGS). The reviewers were concerned that this set may not include all safety and sa fety-related systems from the WOG ERGS except plant-specific deviations. Similarly, the licensee indicated that a " representative" set of scenarios will be defined for the scope of the analysis. Without assurance that the systems selected will be all inclusive (except for plant-specific deviations) and that the scenarios selected will encompass all operator emergency functions and tasks, the reviewers could not conclude that the task analysis will be completed successfully.

[ In response to these concerns, SCE indicated at the In-Progress Audit that the scenarios selected for the task analysis encompassed all safety-related systems and all operator emergency functions and tasks. The audit team inquired whether the systems included in the task analysis covered all safety-related systems in the plant's Final Safety Analysis Report (FSAR).

The licensee responded that it had a Q-list of safety-related systems which was its equivalent to the FSAR, and that a comparison of the Q-list with the systems included in the Westinghouse Owner's Group (WOG) task analysis hid g been conducted. The licensee presented the audit team with.the documenta-tion of this comparison as well as the actual Q-list. A review of this i documentation revealed a number of differences between the Q-list and the

(. WOG generic systems, suggesting that not all safety-related systems would be I i included in the task analysis. The licensee should review this issue and provide assurance in their DCRDR Summary Report that such differences do not impact the task analysis work and that all safety-related systems have been evaluated.

l l

l Second, there was a concern related to the nature of the E0Is and their -

use in the task analysis. In the Program Plan, the licensee indicated that the specific values for information and control requirements will be based on the E0Is raising the concern that if the E0Is were. written to accommo-l date the existing control room design, the task analysis may be descriptive j rather than prescriptive. Through discussions with SCE the audit team concluded that the E01s were written independent of the actual instrumenta-4 l

l

tion and controls in the control room and, thus, did not bias the task ..

analysis. Additionally, the E01s were used only to define operator tasks and notintoperforming required define the thecharacteristics tasks. of the information and controls Third, in the Program Plan, the licensee defined the information and --

control requirements that will be developed in the task analysis as " system compomnt/ parameter" and " relevant characteristics" (p. 3-19, Reference 1).

The chiewers developed. were not clear what " relevant characteristics" will be According to the licensee's Program Plan, the task analysis wei ksheet will contain information and control characteristics including

" type of component, range, units, positions." The reviewers noted that this list did not include the required precision and accuracy of instruments controls. The In-Progress Audit revealed that the value specified for and a

j parameter E is conservative and takes into account instrument error.

Additionally, f

~

and the audit team reviewed the documentation of the information control requirements developed in the task analysis and found it to be satisfactory.

Fourth, there was a concern regarding the licensee's review of the task analysis worksheets using 50NGS-1 experience. Figure 8 (p. 3-12, Reference

1) depicted that the task analysis worksheet will be reviewed by SONGS-1 operations following the task analysis.

c The reviewers were not certain about the nature and purpose of this activity. During the In-Progress Audit, the the task analysislicensee indicated that SCE reviewed the scenarios selected for f' to determine how realistic they were. The DCRDR team j wanted to make certain that the task sequence followed in the scenarios ceflected the actual task sequence in SONGS-1 operations. This activity did nt include a review of the information and control requirements by SCE personnel and, therefore, was found acceptable.

Fifth, the licensee's Program Plan omitted information describing who will identify operator decisions / actions and develop the information and control requirements. Additionally, a description of the control room inventory appeared before the task analysis in the Program Plan. The -

reviewers were concerned that if this reflected the order in which these activities will be performed and the same personnel will be involved in both, then the results of the task analysis will be biased.

A schedule -

5

presented at the audit revealed that the control room inventory was completed prior to the task analysis. However, although General Physics (GP) personnel in the San Diego office conducted the control room inventory, GP personnel in the Columbia, Maryland office performed the final two steps in the task analysis. Thus, different personnel were involved in these activities and the reviewers found this acceptable.

In summary, based upon SAIC's review of all DCRDR documentation provided by the licensee, it appears that SCE should be able to satisfy the NUREG-0737, Supplement I function and task analysis requirement. However, since IE Information Notice No. 86-64, dated August 14, 1986, indicates that many utilities may not have appropriately developed or implemented upgraded emergency operating procedures (E0Ps), tne licensee should verify that the problems with E0Ps identified in this Information Notice are not applicable to SONGS-1. If there are problems, the licensee should consider reevalu-b ating the adequacy of their DCRDR analysis. Additionally, SCE should

{

r provide assurance that the task analysis, in fact, covers all safety-related systems identified in the SONGS-1 Q-list. Until this assurance is provided, the reviewers cannot conclude that this requirement of Supplement I to NUREG-0737 will be satisfied.

3. Comoarison of display and control reouirements with a control room inventory.

I 2

The licensee proposed to use the results of the task analysis to judge f.

the adequacy of the control room inventory. Following the specification of

1. tasks, decision requirements, and information and control requirements, SCE planned ta compare these requirements to the existing instrumentation and controls (I&C) in the control room. The licensee indicated that the first step of this phase will be to construct a control room inventory and list it on the task analysis worksheet in the column "I&C Identification." The parameter, range, scaling units, and related information will be documented i

in a separate listing. During the In-Progress Audit, SCE indicated that the control room inventory had been compiled as outlined in the Program Plan.

In th'e verification of availability, the presence or absence of the information and control requirements that were identified in the task analy-sis will be determined. This will be accomplished by " comparing the 6

l

\ . .

postulated requirements in the 'Information and Control Requirements' column of the task analysis worksheet to the actual control room I&C listed in the 'I&C Identification' column" (p. 3-22, Reference 1) and to the separate listing mentioned above. Whenever required information and controls are not available to the operator, an HED will be documented.

The suitability of information and control needs will be determined by comparing available I&C with the requirements defined by the task analysis. SCE plans to check suitability by asking three main questions:

1) Does the equipment provide appropriate information/ feedback for the tark?

2) Does the equipment provide actual (direct) system status information?

f 3) Is the equipment usable?

The licensee's suitability check will determine "for example, if a meter...

has the appropriate range and scaling to support the operator in the corre-sponding procedural step" (p. 3-23). If the meter is not appropriate, it will be recorded as such on the task analysis worksheet and documented as an HED.

i The principal concern with the approach described was related to the information provided by the task analysis. The reviewers were concerned

{ that if the task analysis was unduly influenced by the existing control

(, room, then the task analysis results, when compared with the control room,

'e would yield few findings. As indicated earlier, the E01s were written independent of the actual instrumentation and controls in the control room and, thus, did not bias the task analysis results.

Another concern with the verification of I&C suitability regarded the information and control characteristics identified in the control room inventory. In the Program Plan, the licensee stated that " parameter, range, scaling units, and related information will be documented" (p. 3-23). The reviewers were not clear what "related information" will be documented.

Thero was a concern that "related information" will not include scale divi-sions or increments. This concern was resolved during the In-Progress Audit i 7

by the licensee's affirmation that scale divisions / increments were identi-fied in the control room inventory.

The next step of the review process will be the validation of control room functions. The licensee's methodology for conducting a validation of control room functions appears to be adequate. The use of walk-throughs with aperators should yield valuable findings. However, there were two concerns related to this validation. First, it was not clear whether auxiliary operator tasks will be included in the validation of control room functions, since there was no precise outline of the scope of the wal k-throughs. Second, SCE plans to use a full-scale photographic mock-up to conduct the walk-throughs. In the Program Plan, the licensee did not indi-cate how limitations of the mock-up will be addressed or how current the mock-up is.

r At the audit the licensee responded to these concerns. SCE stated that e auxiliary operator tasks will be included in the validation exercise as they relate to procedural steps. For auxiliary operator tasks related to proce-dural steps, the validation exercise will determine whether those capabili-ties should be available in the control room. Concerning the mock-up, SCE indicated that the mock-up is current and that any changes made to the control room in the future will be incorporated into the mock-up. SCE addad that no changes are scheduled for the control room for the duration of th'e DCRDR activities.

(i In conclusion, SCE's approach, if executed as proposed, should be adequate for meeting the control room inventory requirement of Supplement I to NUREG-0737. Additionally, the licensee has proposed to conduct a validation of control room functions consistent with the guideliner of NUREG-0700. This validation exercise as documented in the Summary Report should augment the DCRDR review activities.

4. Control room survey to identify deviations from accepted human factors orincioles.

The key to a successful control room survey is a systematic comparison of the control room against accepted human engineering guidelines. One set of human engineering guidelines that is acceptable to the NRC is pro-8

vided by Section 6 of NUREG-0700. Discrepancies between the control room and human engineering guidelines should be documented as HEDs.

The licensee mentioned in the Program Plan that the SONGS-1 survey of the control room will be conducted using human engineering guidelines contained in NUREG-0700. It further mentioned that the survey will be performed by a team composed of human factors engineers and operations personnel in the SONGS-1 control room or in the mock-up for those guidelines that are applicable. However, in the licensee's Program Plan it did not indicate how SCE plans to address dynamic criteria such as operator reach envelope and brightness of indicators that cannot be evaluated using a mock-up. This concern was resolved when the licensee informed the audit team that the survey was conducted in the control room and not on the mock-up as originally proposed.

h The checklists were designed to provide a "yes" or "no" response and f contain both quantitative and qualitative statements. Samples of the check-lists which could have aided the reviewers' evaluation of the methodology were not provided; however, an HED form was provided. The HED form indi-cates that discrepancies will be documented with information for assessment purposes and future retrieval during the corrective phase. 'At the audit, the licensee indicated that the checklist used in the survey uas derive,d from NUREG-0700. While not formally provided during the audit, th'e c

checklists were reviewed by the audit team while conducting a minisurvey -of the control room.

f-f' j The audit team conducted the minisurvey at the full-scale photographic i mock-up. As a result of the minisurvey, the audit team identified several potential HEDs and presented them verbally to SCE. SCE had previously identified most of these HEDs, but had not found five of the HEDs identified i in the minisurvey. However, SCE committed to evaluating all of them. These l HEDs are described in Appendix B.

! In conclusion, the licensee developed a complete program to accomplish j

the control room survey. Although a minisurvey conducted by the audit team identified five HEDs not found in SCE's survey, the audit team found the process to be adequate. Furthermore, SCE committed to evaluating these l HEDs. Based on the information provided in the Program Plan and obtained l 9 l

l 1

t during the In-Progress Audit, it appears that the licensee will satisfy this requirement of Supplement I to NUREG-0737. Although not an explicit requirement of Supplement I to NUREG-0737, the licensee indicated at the audit that the remote shutdown capability will also be surveyed using the l guidance contained in NUREG-0700.

5. Assessment of human enaineerina discrepancies (HEDs) to determine which are sianificant and should be corrected.

The objective of this requirement of Supplement I to NUREG-0737 is to assess human engineering discrepancies (HEDs) identified in the review phase in order to determine which HEDs are significant and should be corrected.

For SCE's DCRDR, the assessment of HEDs does not constitute a separate phase from the selection of design improvements. While not constituting a t

f separate phase from the selection of design improvements, the assessment of

{

HEDs will be independent from f he selection of design improvements.

HEDs will be assessed; and, second, design improvements will be selected.

First, Both steps will be done by the HED assessment team. The HED assessment results and proposed design improvements will then be evaluated by an evaluation team and, finally, authorized or rejected by a site change committee.

s g As described in the licensee's Program Plan, the assessment team will

, review each identified HED to " verify that it is in fact an HED" (p. 4-1).

f HEDs that are not deleted as a result of this review will then be assigned a

! priority based on the potential for error, safety significance, and tech-nical specification conformance. These three factors were considered for their relative importance, and corresponding weights were assigned (poten-tial for error 0.555, safety significance 0.167, unsafe condition or techni-cal specification violation 0.278). When assessing an HED, each factor will-be given a relative magnitude based on a scale ranging from 0 (none) to 5 (very high or documented) to determine scale magnitudes of factors 1, 2, and 3 (MI, M2, and M3). The scale magnitude of each factor will be multiplied by the relative weight of each factor (WI, W2, and W3) and_then summed to get a point value for each HED. The point value determines the assignment of HEDs to nine priority levels. The higher the point value of the HED, the more critical is the need for correction. Priority levels 1, 2, and 3

, appear to be safety-related,.whereas priority levels 4 to 7 appear to be i

10

nonsafety-related but with high potential for error. Priority levels 8 and 9 appear to be neither safety-related nor possessing a high potential for error.

There were several concerns regarding SCE's proposed plan for assessing HEDs.

First, it was not clear why it is necessary to examine discrepancies identified in the review activities to verify that they are really HEDs.

Furthermore, it was not clear how each discrepancy will be " verified" using the criteria provided in Table 1 of the Program Plan. SCE clarified this verification process during the In-Progress Audit. Discrepancies will be examined to identify and cancel those addressed by some other corrective action, those that are redundant with other discrepancies, and those where the solution would create more problems than it would solve. A "yes" answer to any one of the criterion questions in Table 1 of the Program Plan will a

result in the discrepancy being documented as an HED. Accordingly, each h

criterion carries equal weight in the decision-making process.

l A second concern regarded the method for categorizing and establishing priorities for correction of HEDs. From the discussion provided in the Program Plan, it was not clear how SCE arrived at the three weight facters.

At the audit, SCE indicated that the same methodology for weighting factors used in the DCRDR for Units 2 and 3 was used for Unit 1. During the Pre-t Implementation Audit of Units 2 and 3, the human factors consultant (HFC) explained that there were three steps in determining the weights for the three criteria:

t j A -

Potential for error B -

Degree of safety significance C -

Potential for unsafe condition or technical specification violation.

In the first step, the paired-comparison technique was applied to the three criteria. Each criterion was paired and compared with every other criterion and a I was assigned to the criterion judged to be more important.

This comparison resulted in the assignment of 67% to potential for error, 0%

to degree of safety significance, and 33% to potential for unsafe condition or technical specification violation.

11

A B C Total Weicht A -

1 I 2 2/3 =

.667 B 0 -

0 0 0/3 =

.000 C 0 1 -

1 1/3 = .333 (1 = row criterion more important than column criterion.)

The assignment of 0% to degree of safety significance was thought to be unreasonable. Therefore, in the second step a dummy variable was added to the paired-comparison technique so that none of the criteria would receive a weight of 0%. The modified comparison resulted in the assignment of 50% to potential for error,17% to degree of safety significance, and 33% to poten-tial for unsafe condition or technical specification violation.

A B C D Total Weicht i A -

1 1 3 b

1 3/6 = .500 B 0 -

0 1 1/6 .167 f

1 =

C 0 1 -

2

" 1 2/6 = .333 Dummy 0 0 0 -

0 While the modification of the paired-comparison technique had ensured that none of the criteria would receive a weight of 0%, it had also altered the ratio between potential for error and potential for unsafe condition o,r technical specification violation. Prior to the modification, this ratio E

was .667 to .333 or 2:1. In order to maintain this ratio, the weights were adjusted by shifting .055 from potential for error to potential for unsafe f- condition or technical specification violation. This adjustment maintained j the 2:1 ratio (.555 to .270) and resulted in the final weight assignment of 55% to potential for error,17% to degree of safety significance; and 27% to unsafe condition and/or technical specification violation. The audit team found this methodology and the resulting assignment of criterion weights to be acceptable.

In an organization chart entitled "HED Processing" SCE stated that an "HED tay be processed with a majority of team members present." This

' implies that an HED can be assessed (and design improvaments selected) without all team members present. The reviewers were concarned that the necessary expertise, particularly human factors expertise, will not be involved in the assessment of the HEDs -(and the selection of design improve-i l

12 l

ments). This concern was cleared up at the audit with assqrance from the licensee's DCRDR team leader that assessment would not take place without the HFC and the senior reactor operator (SRO) present.

The organization chart also stated that " delegated replacements" can participate in the place of designated members. The licensee's Program Plan provided no indication as to the identity'of these replacements. At the audit, the DCRDR team leader explained that the designated HFC and SR0 would not be replaced and that replacements for other designated members would have adequate backgrounds and be familiar with the DCRDR.

The reviewers also had a question regarding the assessment of cumula-tive effects of the HEDs. In the Program Plan, SCE stated that individual Priority 9 HEDs would be reviewed by the DCRDR team for potential cumulative f or interactive effects. HEDs found to have a potential interactive effect Y

will be reevaluated and reassigned to a higher priority as necessary. It was not clear why only Priority 9 HEDs will be examined for cumulative effects. The licensee would have a more thorough assessment if all Priority 4 through 9 HEDs are examined for cumulative or interactive effects and reassigned to a higher priority as necessary. The licensee concurred with this position at the audit and stated that all HEDs regardless of priority will be evaluated for cumulative or interactive effects.

7 Another concern was the sequence for assessing HEDs and selecting

{ design improvements. On the HED form provided in the Program Plan, recc -

(, mendations for design improvements appear before the category rating. The i reviewers were concerned that if this reflects the order in which these steps will be executed, then this process will lead to an assessment biased L by the recommendations and not purely based on plant safety and probability I

of operator error. In response to this concern, the licensee presented a l new HED form at the audit in which the priority level precedes the recom-mendations for design improvements. The licensee also verified that the HEDs will be assessed prior to the selection of design improvements.

As discussed in the task analysis section, the audit team discovered a number of differences between the SONGS-1 Q-list of safety-related systems and the WOG generic systems. The licensee should ensure that the con-13

sideration of safety-related systems in the assessment will cover all safety-related systems defined in the Q-list.

In summary, SCE satisfactorily responded to the reviewer's earlier concerns. However, a new concern surfaced at the audit as a result of the identification of a number of safety-related systems on the 50NGS-1 Q-list that were not included in the WOG listing of safety-related systems. In order to fully satisfy the assessment requirement of Supplement I to NUREG-0737, the licensee should indicate in its Summary Report that all safety-related systems defined in the Q-list will be considered in HED assessment.

6. Selection of desian imorovements.

From a review of the licensee's Program Plan, it appeared that HEDs f will be assessed and resolved by the HED assessment team and then evaluated by the HED evaluation team and authorized or rejected by the site change committee (SCC). While the Program Plan provided some description of the assessment process, the process for selecting design improvements was not described. There was no description of the techniques to be used in selecting the design improvements or of the criteria to be used in selecting one corrective action over other alternatives.

s During the In-Progress Audit, SCE indicated that the same technique's and criteria utilized in selecting design improvements for Units 2 and 3 y will be utilized for Unit 1. A recommendation is generated by the assess-(, ment team and proceeds through review and possible modification by the i evaluation team and SCC. Panel replicas and drawings will be used as needed in selecting the design improvements. The evaluation team is ultimately responsible for the development of detailed design solutions, while the SCC l provides review concerning issues such as impact on plant operations, cost

benefit, schedule constraints, and other site issues. Any recommendation rejected by the SCC is rerouted through the evaluation team which may.

provide another recommendation. If a resolution cannot be agreed upon, the l

SCC will have the final decision and reasons for disapproval will be docu-l mented.

l Since it appeared that there is no systematic process for the develop-l ment and comparison of alte.rnative means of correcting HECs, the reviewers 14

l l

. l were concerned that corrections may float from committee to committee in a .

piecemeal fashion rather than being presented as a package to the SCC for l approval. This concern was eliminated at the audit when the licensee indi- l cated that the corrective actions will be presented to the SCC in design i packages with the highest priority HED in each design package driving its implementation.

Another concern regarded the composition of the SCC. According to Section 4.3 (p. 4-13) of the Program Plan, the SCC will have "overall responsibility and authority to review and accept or reject the scope, priority, budget category, and schedule" of the recommended corrective actions. Yet, there was no indication that human factors (HF) considera-tions will be taken into account in their final approval and judgments.

SCE's response to this concern was that the DCRDR coordinator and operations i personnel will present HF considerations to the SCC. SCE assured the NRC O that the DCRDR coordinator and operations personnel will provide the neces-f

~

sary HF input and, thus, will present a united front to the SCC. The audit team was satisfied that HF considerations will be well represented to the SCC when it makes its final decisions on HED corrective actions.

One final concern addressed at the audit regarded the implementation schedule. In the Program Plan, the licensee indicated that the development

~

of a schedule to correct HEDs will be based on several factors including

! category assigned, engineering and equipment lead time requirements, and g

plant scheduling constraints. The reviewers were concerned that if the g' development of the implementation schedule is based too heavily on factors j other than safety, HEDs with high safety significance or potential for error (Priority 1, 2, and 3) may not be corrected immediately. The audit team learned that SCE has developed an integrated living schedule (ILS) which l

provides the implementation schedule for the modifications resulting from

! various NUREG-0737 activities. While the ILS represents a compromise l between the various upgrade efforts, SCE assured the audit team that high priority modifications will be implemented first. SCE also confirmed that-the schedule for implementation of DCRDR corrective actions will be included in the Summary Report.

t l

15

In summary, SCE has demonstrated the knowledge and commitment necessary to select and implement design improvements successfully and will likely satisfy this requirement of Supplement 1 to NUREG-0737.

7. Verifications that selected desian imorovements will orovide the neces-sary correction and not introduce new HEDs.

The licensee indicated in the Program Plan that a review is conducted by the HED evaluation team to validate that the corrective actions do not create new HEDs. However, SCE did not present the methods by which it will verify and validate that changes resulting from the DCRDR are effective.

When questioned by the audit team concerning the verification methodology, the licensee indicated that a pinboard and/or full photographic mock-up will be utilized. The verification of HED corrective actions will integrate A

input from human factors specialists, SR0s, aL I&C engineers. Human h

factors guidelines will be reapplied and control room operator walk-throughs E, will be conducted. Finally, procedures will be established to track the progress of design solutions. When accomplished and documented in the Summary Report, this process should satisfy the NUREG-0737, Supplement I requirement to verify that selected design improvements will provide the necessary correction without introducing new HEDs.

8. Coordination of control room improvements with chances from other I

orocrams such as the Safety Parameter Disolav System, operator train-g inc. Reo. Guide 1.97 instrumentation, and uparaded emeroency operatina

(, procedures.

i This requirement of Supplement 1 to NUREG-0737 states that " improve-ments that are introduced should be coordinated with changes resulting from other improvement programs such as SPDS, operator training, new instrumenta-tion (Regulatory Guide 1.97, Rev. 2), and upgraded operating procedures" (p.

11). SCE presented a brief commentary in the Program Plan for the following improvement programs:

- Emergency Operating Instructions (E0Is)

- Safety Parameter Display System (SPDS)

- Regulatory Guide 1.97

- Emergency Response Facilities 16

Of these four programs, SCE only recognized the need to coordinate the DCRDR with the SPDS and Reg. Guide 1.97. Their Program Plan did not have any specific plans to address E01s or ERFs in the DCRDR. In addition, no mention was made of coordinating changes resulting from the DCRDR with operator training programs.

A presentation was given by the licensee during the In-Progress Audit to address this requirement. SCE desciibed an integration process flow diagram which illustrated the Station's coordination program. The audit team reviewed this ccordination diagram, and, with one exception, concluded that it was an acceptable plan for accomplishing the coordination. The ,

licensee concurred with the audit team's finding that the task analysis should feed into the SPDS. In addition, SCE indicated that the DCRDR team has reviewed the other NUREG-0737 improvement programs, and that the DCRDR p team includes key individuals from these other programs. Finally, SCE '

F engineering staff has been assigned the responsibility of coordinating all f

NUREG-0737 improvement programs including the DCRDR, which will serve as the focal point for all of the other programs.

Another concern discussed was the licensee's , intention to use the SPDS as a means for resolving HEDs. The licensee satisfied this concern by assuring the audit team that the SPDS will not serve as the primary instru-ment to provide missing information to the operators. The licensee also e

committed to providing for radioactivity control as a top level critical safety function in the SPDS.

9.

({ In summary, SCE has demonstrated the knowledge and the commitment necessary to coordinate the various Supplement I to NUREG-0737 improvement programs successfully and will likely satisfy this requirement. -

9. Operatino exoerience review.

Although not a requirement of Supplement I to NUREG-0737, review of operating experience is beneficial to the success of the DCRDR. The SCE Program Plan indicated that an operating experience review would be conducted as part of the DCRDR at SONGS-1. Consistent with guidelines in NUREG-0700, a review of plant operating experience, administration of ques-tionnaires to operators, and operator interviews would be included.

17 m uvt. =ul.-_t i

The audit team found that SCE has completed its operating experience

review. The licensee reviewed historical documens including Licensee Event

• Reports (LERs), Station Incident Reports (SIRS), and Nonconformance Reports (NCRs). It used a form similar to Figure 5 of page 3-3 in the Program Plan to summarize and document control room human factors problems identified in the review. Findings from this review activity will receive further con-sideration in subsequent DCRDR activities.

3 SCE's operator survey effort entailed distribution of confidential questionnaires to licensed operations staff. To ensure confidentiality as well as uninhibited responses, only the human factors consultants (HFCs) were involved in the survey effort, and no names were attached to informa-tion obtained in the survey. The basic form of the questionnaires had been used in several previous DCRDRs by the HFCs, thereby ensuring that the survey questions had been pretested for clarity and simplicity. Approxi-F mately 25-30% of the questionnaires were returned and eight follow-up inter-

{

~

views were conducted.

The DCRDR team will review the data to ascertain whether the concerns encountered are HEDs.

In summary, it appears that SCE's operating experience review is con-tributing to the success of the DCRDR.

CONCLUSION e

An In-Progress Audit was conducted for SCE's SONGS-1 on July 15-18, 1986.

f'_

j This presented the licensee with the opportunity to respond to ques-tions and concerns that resulted from the review of the SONGS-1 Program Pl an.

Based on information gathered during the review of the Program -Plan and discussions held during the In-Progress Audit, the following conclusions were drawn:

e SCE has established an acceptable multidisciplinary review team, o

The licensee should provide verifi, cation in the Summary Report that the task analysis covered all safety-related systems from the SONGS-1 Q-list.

18 i

e The control room inventory was generated and found to be adequate for a comparison with required information and control needs. If executed as proposed, SCE's comparison should satisfy this requirement of Supplement I to NUREG-0737.

e The control room survey conducted by the licensee appears to be sufficiently thorough and complete. With SCE's commitment to evaluate the five HEDs identified in the audit team's minisurvey, the control room survey should satisfy this NUREG-0737, Supplement I requirement.

e The licensee should indicate in the Summary Report, that all safety-related systems defined in the SONGS-1 Q-list will be considered in HED assessment.

I e The process for selecting design improvements, when implemented, y should satisfy this requirement of Supplement I to NUREG-0737.

e The process proposed to verify that selected design improvements will provide the necessary correction without introducing new HEDs, when implemented, should satisfy this requirement of Supplement I to NUREG-0737. .

E e The coordination plan developed by SCE should prove successful for f

coordinating the DCRDR with other Supplement I to NUREG-0737 l( improvement programs and, when implemented, should satisfy this

! i requirement.

l Overall, the Southern California Edison Company has developed a Program l Plan that should guide the DCRDR to a successful conclusion. The informa-tion requested above should be provided in the licensee's Summary Report, as should any revisions or changes to the process and procedures described in the Program Plan. Additionally, the Summary Report should include descrip-tions of HEDs, descriptions of corrective actions, justifications for not or only partially correcting HEDs, and the schedule for implementing corrective actions. If all of these issues are resolved and so documented in the Summary Report, the DCRDR at SONGS-1 should be successful.

19

REFERENCES

1. " Control Room Design Review Program Plan," Southern California Edison Company, San Onofre Nuclear Generating Station - Unit 1, December 1985.

2. NUREG-0800 (Standard Review Plan), Revision 0, Section 18-1 and Appen-dix A to Section 18.1, September, 1984.

3. NUREG-0737, Supplement 1, " Requirements for Emergency Response Capa-bility," USNRC, Washington, D.C., December 1982, transmitted to reactor licensees via Generic Letter 82-33, December 17, 1982.

4. NUREG-0700, " Guidelines for Control Room Design Review," USNRC, Wash-ington, D.C., September, 1981.

i t

E.s c

{

(.

I 20

l I '

APPENDJX A DCRDR AUDIT EXIT MEETING July 18,1986 Name Position Affiliation Carol A. Couser Compliance Engr SCE Michael Zenker Compliance Engr SCE Tony Llorens Licensing SCE Jose Ibarra Nuclear Engr SCE Faust Rosa Chief, EICSB USNRC Richard Dudley NRC Project Manager USNRC Michael Thomas Licensing Engineer SCE Joel Kramer Sr. HF Engr, EICSB USNRC

[ Bethany H. Drum NRC HF Contractor USNRC/SAIC Carol Kain

{

David H. Schultz NRC HF Contractor Ops Contractor USNRC/SAIC' USNRC/SAIC/Comex Jerry Prickett CRDR Team Leader SCE George Reeder CRDR Project Group Ldr SCE J.J. Wambold Project Manager SCE Will McGhee Ops Coordinator SCE Jack Rainshery Supervising Engineer SCE g Jeff Yann Mgr. Nuclear Proj. Engr SCE Henry Tobey HF Psychologist General Physics f, Lothar Schroeder HF Engineer

' General Physics b

y A-1

. t

. . +

APPENDIX B NRC AUDIT TEAM MINISURVEY RESULTS HEDs identified by the audit team that were not found in SCE's survey effort:

e Alarms on diesel generator panel direct auxiliary operators to another plant locatifon. (6.3.1.28-1) e H-Lo Annunciators have inout from multiple plant parameters.

(6.3.1.2C-1)

- e First out panel does not have separate annunciator tile for auto f first out function. (6.4.1.2B-1) kr e Control rod lever on J-console is not shielded to prevent accidental activation (6.4.1.2B-1) e Several controls on the J-console are difficult to operate; such as the feedwater valves process controllers and the mode of operation switch. The licensee indicated that these items were e deferred to the suitability verification. The licensee should verify that these items are addressed in the suitability verification. (6.4.1.1A-2) 8 i

f l B-1 l

i

c .-

q . L s

t DEC 0 31989 Distr.1butipp, Copies:

%ket1F11es-NRC PDR Local PDR PAD #1 r/f PAD #1 p/f TNovak, Actg. DD NThompson, DHFT OGC-Bethesda EJordan BGrimes JPartlow Glear PShuttleworth RDudley JKramer SWeiss FRosa ACRS(10)

LFMS(TAC #56162) s I

L J

9 M

+

[- g _